CVE-2026-88285

GeoVision's GV-LPC2211 license plate capture camera running firmware V1.13 exposes its PTZ (pan-tilt-zoom) control service over the network without any authentication (CWE-306, Missing Authentication for Critical Function). Any remote client that can reach the camera on the network can connect directly to this service to read PTZ status and issue PTZ movement or raw serial commands, with no credentials, user interaction, or special conditions required. An attacker gains full control of the camera's pan/tilt/zoom behavior and can drive any device connected to the camera's serial port, consistent with the 9.4 CVSS score's high integrity and availability impact and limited confidentiality impact. Affected users are operators of GV-LPC2211 cameras on firmware V1.13 whose PTZ service is reachable from untrusted networks; the available data specifies no other version ranges and no fixed version. There are no known public proofs of concept, the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported.

What to do: No fixed firmware version is specified in the available data, so check GeoVision advisories for GV-LPC2211 firmware updates and upgrade when a patched release is published. In the meantime, restrict network access to the camera's PTZ control service via firewall ACLs or VLAN segmentation and avoid exposing it directly to the internet, since any reachable client can command PTZ and raw serial traffic. Operators with peripherals attached to the camera's serial port should treat those devices as reachable by unauthenticated network clients and monitor for unexpected PTZ movement or serial activity.